Gmail, Yahoo and Outlook sender rules: where texts fit

From February 2024, Google and Yahoo started enforcing rules for anyone who emails their users in bulk, and Microsoft followed for Outlook.com on 5 May 2025. The three sets of rules say much the same thing: prove the email really comes from your domain (SPF, DKIM and DMARC), let people unsubscribe in one click, and keep complaints low. Gmail and Yahoo both draw the line at a spam complaint rate of 0.3%, three reports in every thousand messages. Gmail said it would ramp up enforcement from November 2025, with temporary and permanent rejections for mail that fails.

None of this applies to texts, which run under different rules. But it has changed what it takes to get a routine email delivered, and that makes it worth looking again at which messages a business sends by email and which by text.

What does Gmail require?

Google's email sender guidelines split senders in two. Since 1 February 2024 everyone sending to personal Gmail accounts has had to authenticate with SPF or DKIM, have valid forward and reverse DNS for their sending servers, use TLS, format messages to the internet standard and "keep spam rates reported in Postmaster Tools below 0.3%".

The stricter rules apply to bulk senders. Google's FAQ defines one as any sender that "sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period", counting everything sent from the same primary domain, so mail from a shop's main domain and from its newsletter subdomain adds up. One day over the line is enough: "Senders who meet the above criteria at least once are permanently considered bulk senders." New domains, meaning any that hadn't sent more than 5,000 emails a day to personal Gmail accounts since 1 January 2024, face enforcement on what Google calls "an accelerated timetable". A bulk sender needs SPF and DKIM both, a DMARC record (a policy of "none" will do), and the domain in the From: line aligned with one of them. Marketing messages "must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body".

Google's FAQ fills in the dates. Senders that already had an unsubscribe link were given until 1 June 2024 to add one-click unsubscribe, done to the standard in RFC 8058, an IETF document from January 2017 that defines a List-Unsubscribe-Post header so a mail app can unsubscribe someone with one tap. A mailto link in the body doesn't count. Google recommends removing people "within 48 hours", and lists unsubscribes not honoured in that time among the issues that cost a sender its delivery support. Transactional messages are exempt from the unsubscribe rule, and Google's examples are "password reset messages, reservation confirmations, and form submission confirmations".

The complaint threshold is graduated. Google says senders should "keep their spam rate below 0.1% and should prevent spam rates from ever reaching 0.3% or higher", that spam rates above 0.1% already hurt inbox delivery for bulk senders, and that a sender above 0.3% isn't eligible for Google's delivery mitigation until its rate has stayed under 0.3% for seven days in a row. Mail that fails the authentication rules can be sent to spam or rejected (Google's bounce code for unauthenticated mail is 5.7.26), and from November 2025, in Google's words, "Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections."

These rules cover personal Gmail accounts only, not Google Workspace addresses, and that's still a lot of people: Ofcom's Online Nation 2025 report found Gmail used by 58% of UK online adults in May 2025, and its smartphone app opened by 36% of them on an average day.

What do Yahoo and Outlook require?

Yahoo's sender page gives a February 2024 start too, with enforcement "gradually rolled out" through the first half of that year. All senders need SPF or DKIM, valid DNS and a spam rate below 0.3%. Bulk senders need SPF and DKIM, a DMARC policy that passes, a working one-click List-Unsubscribe header, a visible unsubscribe link, and to "Honor unsubscribes within 2 days". Yahoo doesn't put a number on "bulk" on that page.

Microsoft announced its rules on 2 April 2025, for Outlook.com, "our consumer service, which is supporting hotmail.com live.com and outlook.com consumer domain addresses". They apply to "domains sending more than 5,000 emails per day": SPF must pass, DKIM must pass, and DMARC must be set to at least p=none and align with one of the two. The original plan was to send failing mail to Junk first. An update on 29 April 2025 changed that to rejection from 5 May, with the bounce message "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Microsoft also asks large senders for working unsubscribe links, clean lists and recipients who "have consented to receive your messages".

Who decides what counts as marketing?

The recipient, mostly. Google's FAQ says the line between promotional and transactional mail "can vary depending on industry and applicable regulations", and then puts it bluntly: "Message recipients, not Google, determine the nature of the messages they receive." A booking confirmation with a discount code stapled to the bottom may feel like marketing to the person reading it, and if they report it, it counts against your spam rate whatever you called it.

The one-click rule is also narrower than it sounds. A List-Unsubscribe header only removes the person from the list that message came from, so someone can drop the newsletter and keep the order updates, and a separate link in the body can go to a preferences page.

What changed for a UK business that emails customers?

The authentication work lands on whoever controls the domain. SPF is a DNS record listing the servers allowed to send your mail, DKIM signs each message with a key published in your DNS, and DMARC publishes your policy for mail that fails those checks. If you send through an email platform, Google's own advice is to check that "they authenticate your domain's email with SPF and DKIM". A platform that signs with its own domain instead of yours won't meet the alignment rule.

The 5,000 line is lower than it sounds. It counts only personal Gmail addresses, but every message from your domain to them counts, newsletters and receipts together, and crossing it once makes the status permanent. If half the addresses on your list are Gmail ones, a single send to 10,000 customers reaches the line.

The complaint limit is the one to watch. At 0.3%, a send to 10,000 Gmail addresses can afford 30 people pressing "report spam", and Google says the trouble starts above 10. Mailing people who've forgotten signing up is a quick way over it.

Then there's the law, which the mailbox rules sit on top of. Under PECR, the ICO says you mustn't send electronic mail marketing to individuals unless "they have specifically consented to electronic mail from you", or they're existing customers covered by the soft opt-in, and you must give "a valid contact address so they can opt out or unsubscribe". The same rule covers marketing texts, so getting consent right serves both channels (our guide to SMS marketing rules has the detail).

Which messages are better as texts?

The new rules are a good prompt to check which messages belong in email at all. A text doesn't depend on your domain's reputation with Google, Yahoo or Microsoft, and it goes to a mobile, which 98% of UK adults personally use. Ofcom's March 2026 Technology Tracker shows how much wider that reach is. On our reading of its weighted counts, 94% of UK adults had sent or received a text through their mobile network in the previous three months, against 78% who had used email. Among over-75s it was 77% against 57%.

That points to a sensible split. Time-critical service messages suit a text, such as an appointment tomorrow or a delivery today. So do Google's own examples of transactional email, reservation confirmations above all, which a customer wants to see when it matters. Email suits long messages, attachments, receipts people file and newsletters they chose to read at their own pace. Our post on email vs SMS benchmarks compares what each channel can measure.

Texts have rules of their own, mind. Marketing texts need the same consent as marketing email, every one needs a way to opt out, and the reply route depends on how you send. A text from a number can take a STOP reply. A text from a sender name can't be replied to at all, so its opt-out has to be a number or link in the wording.

A short checklist

1. Check your domain has SPF, DKIM and a DMARC record, and that your email platform signs with your domain, not its own.
2. Add one-click unsubscribe headers to marketing email and remove people within 48 hours, which covers Google's recommendation and Yahoo's two days.
3. Watch your Gmail spam rate in Postmaster Tools and keep it under 0.1%. Pause a campaign if it climbs.
4. Move time-critical service messages to text for customers who've given you a mobile number, and keep email for the long and the filed.
5. Collect consent once, with wording that names each channel you'll use for marketing.

If your team runs on email, CaptiFi Connect's email to SMS turns an email from a verified address into a text to a UK mobile, so a reminder can go out as a text from the inbox you already use.

Yahoo says its requirements "are subject to change" and Google's FAQ asks senders to "check back regularly", so put a date in the diary to reread both pages.